Android.Packed.38809

Technical information

Malicious functions:

Executes code of the following detected threats:

Android.DownLoader.683.origin

Gains access to the ITelephony private interface.

Network activity:

Connecting to:

UDP(DNS) <Google DNS>
TCP(HTTP/1.0) 4####.92.62.1:80
TCP(HTTP/1.0) pis.al####.com:80
TCP(HTTP/1.1) a####.u####.com:80
TCP(HTTP/1.1) cdn.app.h####.top:80
TCP(HTTP/1.1) hm.b####.com:80
TCP(HTTP/1.1) m####.gam####.cn.####.com:80
TCP(HTTP/1.1) pus.al####.com:80
TCP(HTTP/1.1) i####.gam####.cn.####.com:80
TCP(HTTP/1.1) aserver####.m.ta####.com:80
TCP(HTTP/1.1) zhusho####.gam####.cn:80
TCP(HTTP/1.1) pss.al####.com:80
TCP(HTTP/1.1) gdv.a.s####.com:80
TCP(HTTP/1.1) mf####.gam####.cn.####.com:80
TCP(HTTP/1.1) 1####.76.224.67:80
TCP(TLS/1.0) pns.al####.com:443
TCP(TLS/1.0) l####.4####.top:443

DNS requests:

a####.u####.com
cdn.app.h####.top
chan####.s####.com
hm.b####.com
i####.gam####.cn
l####.4####.top
m####.gam####.cn
mf####.gam####.cn
pis.al####.com
pl####.y####.com
pns.al####.com
pss.al####.com
pus.al####.com
zhusho####.gam####.cn

HTTP GET requests:

aserver####.m.ta####.com/jsapi
aserver####.m.ta####.com/unifull/css/unifull.min.css?v=####
cdn.app.h####.top/swenjian/321
cdn.app.h####.top/swenjian/321m
gdv.a.s####.com/api/2/topic/load?page_size=50&style=&hot_size=1&topic_so...
gdv.a.s####.com/stat/uvstat?platform=####&uuid=####&client_id=####
hm.b####.com/hm.gif?cc=####&ck=####&cl=####&ds=####&vl=####&ep=####&et=#...
hm.b####.com/hm.gif?cc=####&ck=####&cl=####&ds=####&vl=####&et=####&ja=#...
hm.b####.com/hm.js?a6dafb1####
i####.gam####.cn.####.com/2016/04/02/1021045-1604021R9450-L.jpg
i####.gam####.cn.####.com/2016/04/09/1021045-16040Z94Z70-L.jpg
i####.gam####.cn.####.com/2016/04/13/1021045-1604131129350-L.jpg
i####.gam####.cn.####.com/2016/08/16/1021045-160Q6143R40-50.jpg
i####.gam####.cn.####.com/2016/08/16/1021045-160Q6143R40.jpg
i####.gam####.cn.####.com/2016/08/16/115-160Q61IU30.jpg
i####.gam####.cn.####.com/2018/04/27/2745860-1P42G216220.jpg
i####.gam####.cn.####.com/2018/04/27/2745860-1P42G356140.jpg
i####.gam####.cn.####.com/2018/05/29/2745860-1P529114F80.jpg
i####.gam####.cn.####.com/2018/06/28/2745860-1P62Q209350.jpg
i####.gam####.cn.####.com/2018/07/05/2745860-1PF51044010.jpg
i####.gam####.cn.####.com/2018/07/05/2745860-1PF51046010.jpg
i####.gam####.cn.####.com/2018/07/06/2745860-1PF61210480.jpg
i####.gam####.cn.####.com/2018/07/06/2745860-1PF6121R10.jpg
m####.gam####.cn.####.com/2016/04/26/1021045-1604261459190.jpg
m####.gam####.cn.####.com/2016/05/12/1021045-160512101F90.jpg
m####.gam####.cn.####.com/2016/06/07/1021045-16060F95Q40.jpg
m####.gam####.cn.####.com/2016/06/15/1021045-1606151141420.jpg
m####.gam####.cn.####.com/2016/06/30/1021045-1606301133330.jpg
m####.gam####.cn.####.com/2016/08/26/175-160R61515050.jpg
m####.gam####.cn.####.com/2016/09/13/1021045-1609131440490-50.jpg
m####.gam####.cn.####.com/2016/09/24/1021045-160924141I80.jpg
m####.gam####.cn.####.com/2016/09/25/1021045-1609251423560.jpg
m####.gam####.cn.####.com/2016/10/09/1021045-1610091434580.jpg
m####.gam####.cn.####.com/2016/10/13/1021045-161013142U20-50.jpg
mf####.gam####.cn.####.com/2016/08/15/1021045-160Q51433110.jpg
mf####.gam####.cn.####.com/2016/08/16/1021045-160Q6143R40-50.jpg
mf####.gam####.cn.####.com/2016/08/16/1021045-160Q6143R40.jpg
mf####.gam####.cn.####.com/2017/03/21/1720731-1F3211256120.jpg
mf####.gam####.cn.####.com/2017/03/21/1720731-1F321125S90.jpg
mf####.gam####.cn.####.com/2017/03/21/1720731-1F3211300080.jpg
mf####.gam####.cn.####.com/2017/11/29/1984067-1G1291G5540-L.jpg
mf####.gam####.cn.####.com/2017/11/29/1984067-1G12ZZ1430.jpg
mf####.gam####.cn.####.com/2018/01/15/1984067-1P1151514370.jpg
mf####.gam####.cn.####.com/2018/04/11/2745860-1P4111432170.jpg
mf####.gam####.cn.####.com/2018/04/27/2745860-1P42G216220.jpg
mf####.gam####.cn.####.com/2018/06/04/2745860-1P604113K70.jpg
mf####.gam####.cn.####.com/2018/07/05/2745860-1PF51044010.jpg
mf####.gam####.cn.####.com/2018/07/05/2745860-1PF51046010.jpg
mf####.gam####.cn.####.com/2018/07/05/2745860-1PF5114F30.jpg
mf####.gam####.cn.####.com/js/jquery.min.js
pus.al####.com/kernal/sdkcontrol/vod_android-mobile_x86_9.1.1.1220.jpg
zhusho####.gam####.cn/api/cyhx/AppVersion.xml
zhusho####.gam####.cn/index.php?m=####&a=####&aid=####
zhusho####.gam####.cn/index.php?m=####&a=####&page=####&typeid=####&flag...
zhusho####.gam####.cn/index.php?m=####&a=####&pageSize=####&page=####&ty...

HTTP POST requests:

a####.u####.com/app_logs
pis.al####.com/p/pcdn/i.php?v=####
pss.al####.com/iku/log/acc
pss.al####.com/iku/log/acc?ver=####&flag=####&t=####&mytype=####

Modified file system:

Creates the following files:

/data/data/####/-10813310522058461232
/data/data/####/-10813310522058461945
/data/data/####/-10813310522058461947
/data/data/####/.imprint
/data/data/####/.jg.ic
/data/data/####/1003943842-1501756990
/data/data/####/1824952415497499439
/data/data/####/1824952415497499439 (deleted)
/data/data/####/51b751a6-b2ff-446f-8f37-19191a5b6f83.jar
/data/data/####/76fbd85c-65ac-4d0f-b466-905c964dd781
/data/data/####/9bd297c9-48f6-45f6-9ff8-6e6c91d1e9b9
/data/data/####/AppStore.xml
/data/data/####/Gga.xml
/data/data/####/Php.xml
/data/data/####/Ro.jar
/data/data/####/Ro.xml
/data/data/####/SUBOXLOG_
/data/data/####/UmengLocalNotificationStore.db-journal
/data/data/####/Zai.jar
/data/data/####/Zai.xml
/data/data/####/b726bc41-644a-45f3-bce8-377b75f01bbd.jar
/data/data/####/bzwn.db-journal
/data/data/####/com.dsgfsd.dfwgree.dex
/data/data/####/crossfireassist.db-journal
/data/data/####/crossfireassist.xml
/data/data/####/data_0
/data/data/####/data_1
/data/data/####/data_2
/data/data/####/data_3
/data/data/####/ebn.xml
/data/data/####/f_000001
/data/data/####/f_000002
/data/data/####/f_000003
/data/data/####/index
/data/data/####/jg_so_upgrade_setting.xml
/data/data/####/libjiagu.so
/data/data/####/libpcdn_acc.zip
/data/data/####/libpcdn_acc.zip (deleted)
/data/data/####/libpcdn_acc_new.so
/data/data/####/mobclick_agent_cached_com.dsgfsd.dfwgree20170920
/data/data/####/mobclick_agent_online_setting_com.dsgfsd.dfwgree.xml
/data/data/####/pcdnconfigs.xml
/data/data/####/qihoo_jiagu_crash_report.xml
/data/data/####/register.xml
/data/data/####/temp.dex
/data/data/####/trinea_android_common.db-journal
/data/data/####/umeng_general_config.xml
/data/data/####/umeng_it.cache
/data/data/####/umeng_message_state.xml
/data/data/####/uuid.xml
/data/data/####/webview.db-journal
/data/data/####/webviewCookiesChromium.db-journal
/data/media/####/-991417278827823106
/data/media/####/.nomedia
/data/media/####/1464888506-901080124
/data/media/####/http___img1_gamedog_cn_2016_04_02_1021045_1604..._L_jpg
/data/media/####/http___img1_gamedog_cn_2016_04_09_1021045_1604..._L_jpg
/data/media/####/http___img1_gamedog_cn_2016_04_13_1021045_1604..._L_jpg
/data/media/####/http___img1_gamedog_cn_2016_08_16_115_160Q61IU30_jpg
/data/media/####/http___img1_gamedog_cn_2017_11_29_1984067_1G12..._L_jpg
/data/media/####/http___img1_gamedog_cn_2018_01_15_1984067_1P11...70_jpg
/data/media/####/http___img1_gamedog_cn_2018_04_11_2745860_1P41...70_jpg
/data/media/####/http___img1_gamedog_cn_2018_04_27_2745860_1P42G216220_jpg
/data/media/####/http___img1_gamedog_cn_2018_04_27_2745860_1P42G356140_jpg
/data/media/####/http___img1_gamedog_cn_2018_05_29_2745860_1P529114F80_jpg
/data/media/####/http___img1_gamedog_cn_2018_06_04_2745860_1P604113K70_jpg
/data/media/####/http___img1_gamedog_cn_2018_06_28_2745860_1P62Q209350_jpg
/data/media/####/http___img1_gamedog_cn_2018_07_05_2745860_1PF51044010_jpg
/data/media/####/http___img1_gamedog_cn_2018_07_05_2745860_1PF51046010_jpg
/data/media/####/http___img1_gamedog_cn_2018_07_05_2745860_1PF5114F30_jpg
/data/media/####/http___img1_gamedog_cn_2018_07_06_2745860_1PF61210480_jpg
/data/media/####/http___img1_gamedog_cn_2018_07_06_2745860_1PF6121R10_jpg
/data/media/####/http___mimg1_gamedog_cn_2016_04_26_1021045_160...90_jpg
/data/media/####/http___mimg1_gamedog_cn_2016_05_12_1021045_160...90_jpg
/data/media/####/http___mimg1_gamedog_cn_2016_06_07_1021045_160...40_jpg
/data/media/####/http___mimg1_gamedog_cn_2016_06_15_1021045_160...20_jpg
/data/media/####/http___mimg1_gamedog_cn_2016_06_30_1021045_160...30_jpg
/data/media/####/http___mimg1_gamedog_cn_2016_08_15_1021045_160...10_jpg
/data/media/####/http___mimg1_gamedog_cn_2016_08_26_175_160R61515050_jpg
/data/media/####/http___mimg1_gamedog_cn_2016_09_13_1021045_160...50_jpg
/data/media/####/http___mimg1_gamedog_cn_2016_09_24_1021045_160...80_jpg
/data/media/####/http___mimg1_gamedog_cn_2016_09_25_1021045_160...60_jpg
/data/media/####/http___mimg1_gamedog_cn_2016_10_09_1021045_161...80_jpg
/data/media/####/http___mimg1_gamedog_cn_2016_10_13_1021045_161...50_jpg
/data/media/####/http___mimg1_gamedog_cn_2017_03_21_1720731_1F3...20_jpg
/data/media/####/http___mimg1_gamedog_cn_2017_03_21_1720731_1F3...80_jpg
/data/media/####/http___mimg1_gamedog_cn_2017_03_21_1720731_1F3...90_jpg
/data/media/####/http___mimg1_gamedog_cn_2017_11_29_1984067_1G12ZZ1430_jpg
/data/media/####/myself.dat

Miscellaneous:

Executes next shell scripts:

chmod 755 <Package Folder>/.jiagu/libjiagu.so

Loads the following dynamic libraries:

libjiagu
libpcdn_acc
pcdn_acc
qrve

Uses the following algorithms to decrypt data:

AES
AES-ECB-PKCS5Padding

Uses special library to hide executable bytecode.

Gains access to network information.

Gains access to telephone information (number, imei, etc.).

Gains access to information about APN settings.

Gains access to information about running applications.

Displays its own windows over windows of other applications.

Technologies

Terminology

Training and education

Myths

Technical information

Curing recommendations

Free trial